Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco patches nine Crosswork and Secure Workload flaws, five rated CVSS 10.0, found internally with no exploitation observed.
Cisco released fixes for four Crosswork platform vulnerabilities including CVE-2026-20030 SQL injection and CVE-2026-20357 missing authentication, both scoring CVSS 10.0, affecting Crosswork Release 7.2.1 and earlier. Five additional flaws in Secure Workload, including CVE-2026-20315 and CVE-2026-20317 at CVSS 10.0, affect SaaS and on-premises deployments up to releases 3.10 and 4.0. All issues were found through internal testing and are not known to be actively exploited. The patches follow a broader internal security review that recently addressed 12 Catalyst SD-WAN and IOS XE bugs.
- CVE-2026-20030 (CVSS 10.0) is SQL injection in Crosswork platforms
- CVE-2026-20357 and CVE-2026-20358 also rated CVSS 10.0 in Crosswork
- Secure Workload fixes include CVE-2026-20315 and CVE-2026-20317 (CVSS 10.0)
- Fixed in Crosswork 7.2.1-SP, Secure Workload 3.10.9.1, and 4.0.4.16
- No active exploitation reported; flaws found in internal testing
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-20357+3 related CVEs | Missing Authentication for Critical Functions in Cisco Crosswork | 10.0 group max | <1% | ||
CVE-2026-20315+2 related CVEs | Unauthenticated Improper Access Control in Cisco Secure Workload | 10.0 group max | <1% | ||
CVE-2026-20317+1 related CVE | Improper Authentication Flaws in Cisco Secure Workload Score CVSS 10.0 | 10.0 group max | <1% | ||
| CVE-2026-20349 | Unauthenticated Remote DoS in Cisco ASA/FTD SSL VPN Service | 8.6 | 1% | KEVPoC | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 21, 2026 Vulnerability / Enterprise Security Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.